GitLost: How We Tricked GitHub's AI Agent into Leaking Private Repos
TLDR Dev
Researchers at Noma Labs discovered a prompt injection vulnerability in GitHub's Agentic Workflows that allowed unauthenticated attackers to extract private repository contents by posting crafted GitHub Issues. The attack required no credentials and successfully leaked README files from private repositories as public comments on issues. GitHub's guardrails failed when researchers added the word "Additionally" to their malicious instructions, highlighting how AI agents lack proper trust boundaries between system directives and untrusted user data.
Why it matters
Noma Labs uncovered a critical vulnerability named GitLost in GitHub's Agentic Workflows that allowed unauthorized users to extract data from private repositories by exploiting an indirect prompt injection attack through public GitHub issues.
